https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:01:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342351 EUVD-2026-342351 https://cve.radiocsirt.org/vuln/euvd-2026-342351 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55415 <p>datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.</p> <p>datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling through Import.from_full_path and Imports.create_line in src/datamodel_code_generator/imports.py, allowing a newline to break out of an import statement and execute Python code when the generated model is imported. This issue is fixed in version 0.64.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55415 https://cve.radiocsirt.org/vuln/ghsa-5578-w22f-pfx9 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>#### Summary</p> <p>A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that **imports** the generated model. The `x-python-import` and `customTypePath` schema extensions flow, unsanitized, into the `import` statements datamodel-code-generator emits. A newline embedded in the extension value breaks out of the `from … import …` line and injects an attacker-controlled statement at module scope, which runs at import time. This is an unauthenticated, schema-content–driven remote code execution against any consumer of the generated code (e.g. arbitrary file read,the PoC exfiltrates `/etc/passwd`). It survives the v0.61.0 security release that fixed the related `x-python-type`, `default_factory`, GraphQL-union-description, and `validators` sinks those fixes did not cover this sibling path.</p> <p>#### Details</p> <p>The sink is `Import.from_full_path` and `Imports.create_line`:</p> <p>- `src/datamodel_code_generator/imports.py:35` — `from_full_path()` only does `class_path.split(&#34;.&#34;)` and preserves every other character, **including newlines**: ```python @classmethod @lru_cache def from_full_path(cls, class_path: str) -&gt; Import: split_class_path: list[str] = class_path.split(&#34;.&#34;) return cls(import_=split_class_path[-1], from_=&#34;.&#34;.join(split_class_path[:-1]) or None) ``` - `src/datamodel_code_generator/imports.py:64` — `create_line()` renders the result verbatim: ```python def create_line(self, from_: str | None, imports: set[str]) -…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>#### Summary</p> <p>A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that **imports** the generated model. The `x-python-import` and `customTypePath` schema extensions flow, unsanitized, into the `import` statements datamodel-code-generator emits. A newline embedded in the extension value breaks out of the `from … import …` line and injects an attacker-controlled statement at module scope, which runs at import time. This is an unauthenticated, schema-content–driven remote code execution against any consumer of the generated code (e.g. arbitrary file read,the PoC exfiltrates `/etc/passwd`). It survives the v0.61.0 security release that fixed the related `x-python-type`, `default_factory`, GraphQL-union-description, and `validators` sinks those fixes did not cover this sibling path.</p> <p>#### Details</p> <p>The sink is `Import.from_full_path` and `Imports.create_line`:</p> <p>- `src/datamodel_code_generator/imports.py:35` — `from_full_path()` only does `class_path.split(&#34;.&#34;)` and preserves every other character, **including newlines**: ```python @classmethod @lru_cache def from_full_path(cls, class_path: str) -&gt; Import: split_class_path: list[str] = class_path.split(&#34;.&#34;) return cls(import_=split_class_path[-1], from_=&#34;.&#34;.join(split_class_path[:-1]) or None) ``` - `src/datamodel_code_generator/imports.py:64` — `create_line()` renders the result verbatim: ```python def create_line(self, from_: str | None, imports: set[str]) -…</p> https://cve.radiocsirt.org/vuln/ghsa-5578-w22f-pfx9 https://cve.radiocsirt.org/vuln/pysec-2026-3557 <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>#### Summary</p> <p>A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that **imports** the generated model. The `x-python-import` and `customTypePath` schema extensions flow, unsanitized, into the `import` statements datamodel-code-generator emits. A newline embedded in the extension value breaks out of the `from … import …` line and injects an attacker-controlled statement at module scope, which runs at import time. This is an unauthenticated, schema-content–driven remote code execution against any consumer of the generated code (e.g. arbitrary file read,the PoC exfiltrates `/etc/passwd`). It survives the v0.61.0 security release that fixed the related `x-python-type`, `default_factory`, GraphQL-union-description, and `validators` sinks those fixes did not cover this sibling path.</p> <p>#### Details</p> <p>The sink is `Import.from_full_path` and `Imports.create_line`:</p> <p>- `src/datamodel_code_generator/imports.py:35` — `from_full_path()` only does `class_path.split(&#34;.&#34;)` and preserves every other character, **including newlines**: ```python @classmethod @lru_cache def from_full_path(cls, class_path: str) -&gt; Import: split_class_path: list[str] = class_path.split(&#34;.&#34;) return cls(import_=split_class_path[-1], from_=&#34;.&#34;.join(split_class_path[:-1]) or None) ``` - `src/datamodel_code_generator/imports.py:64` — `create_line()` renders the result verbatim: ```python def create_line(self, from_: str | None, imports: set[str]) -…</p> <p><strong>Affected:</strong> PyPI: datamodel-code-generator</p> <p>#### Summary</p> <p>A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that **imports** the generated model. The `x-python-import` and `customTypePath` schema extensions flow, unsanitized, into the `import` statements datamodel-code-generator emits. A newline embedded in the extension value breaks out of the `from … import …` line and injects an attacker-controlled statement at module scope, which runs at import time. This is an unauthenticated, schema-content–driven remote code execution against any consumer of the generated code (e.g. arbitrary file read,the PoC exfiltrates `/etc/passwd`). It survives the v0.61.0 security release that fixed the related `x-python-type`, `default_factory`, GraphQL-union-description, and `validators` sinks those fixes did not cover this sibling path.</p> <p>#### Details</p> <p>The sink is `Import.from_full_path` and `Imports.create_line`:</p> <p>- `src/datamodel_code_generator/imports.py:35` — `from_full_path()` only does `class_path.split(&#34;.&#34;)` and preserves every other character, **including newlines**: ```python @classmethod @lru_cache def from_full_path(cls, class_path: str) -&gt; Import: split_class_path: list[str] = class_path.split(&#34;.&#34;) return cls(import_=split_class_path[-1], from_=&#34;.&#34;.join(split_class_path[:-1]) or None) ``` - `src/datamodel_code_generator/imports.py:64` — `create_line()` renders the result verbatim: ```python def create_line(self, from_: str | None, imports: set[str]) -…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3557